Valine.js

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Valine.js records in CISA KEV

No Valine.js vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Valine 4 records HIGH

Records

4 records in Valine · all components

TI-2022-18133 CVE-2022-38545 · GHSA-mcvg-g9wx-v5vx

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability…

HIGH 66

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.34128 Published 2022-09-19 Fixed in 1.5.0 CWE-79

TI-2018-13676 CVE-2018-19289 · GHSA-hhrp-qm88-xjr3

An issue was discovered in Valine v1.3.3.

LOW 30

An issue was discovered in Valine v1.3.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01228 Published 2018-11-15 Fixed in 1.3.4 CWE-79

TI-2021-13797 CVE-2021-34801 · GHSA-p2c4-gxp4-j3xp

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage)…

LOW 27

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01721 Published 2021-06-16 No fix listed CWE-94

TI-2020-17409 CVE-2020-28847 · GHSA-6xvq-2gj8-4276

Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.

LOW 25

Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00472 Published 2022-04-05 Fixed in 1.4.15 CWE-79

Open these records in search →